Client and session

createOpenCloudClient(options?)

Create one client per app origin.

const opencloud = createOpenCloudClient();

Browser defaults are correct for deployed apps. baseUrl, fetch, WebSocket, automaticSessionRefresh, and now exist primarily for tests. baseUrl must be an origin and all runtime calls remain same-origin.

config()

config(): Promise<OpenCloudRuntimeConfig>

Returns:

{
  "appId": "6f9619ff-8b86-4e6e-a62a-889950f42d3e",
  "deploymentVersion": "2026.07.28-1",
  "visibility": "private",
  "supabaseUrl": "https://example.opencloud.ai",
  "supabaseAnonKey": "public-project-identity",
  "storageBucket": "app-6f9619ff-8b86-4e6e-a62a-889950f42d3e",
  "functionsBasePath": "/functions/v1",
  "javascriptSdk": {
    "package": "@opencloud/js",
    "version": "0.2.2",
    "module": "/_opencloud/sdk/js/v0.2.2/index.js",
    "types": "/_opencloud/sdk/js/v0.2.2/index.d.ts",
    "docs": "https://docs.opencloud.ai/sdk/javascript/"
  },
  "browserClient": "/_opencloud/sdk/js/v0.2.2/index.js",
  "environment": "prod"
}

browserClient is a compatibility alias for javascriptSdk.module.

session({ refresh? })

session(options?: { refresh?: boolean }): Promise<OpenCloudSession | null>

The safe session contains userId, profile.email, profile.displayName, profile.avatarUrl, accessTokenExpiresAt, refreshAfter, and sessionExpiresAt.

const session = await opencloud.session();
if (!session) {
  renderSignedOut();
} else {
  renderUser(session.profile.displayName ?? session.profile.email);
}

A public app can legitimately return null. A private app is authenticated at the edge, so an unexpected null should render a retry or sign-in state. Public signed-out discovery uses a successful typed broker response rather than an expected HTTP error.

dispose()

Stops scheduled session refresh and clears cached session state. Close Realtime channels separately before disposing the client.